Slashdot Mirror
Sniffing Browser History Without Javascript
Ergasiophobia alerts us to a somewhat alarming technology demonstration, in which a Web site you visit generates a pretty good list of sites you have visited — without requiring JavaScript. NoScript will not protect you here. The only obvious drawbacks to this method are that it puts a load on your browser, and that it requires a list of Web sites to check against. "It actually works pretty simply — it is simpler than the JavaScript implementation. All it does is load a page (in a hidden iframe) which contains lots of links. If a link is visited, a background (which isn't really a background) is loaded as defined in the CSS. The 'background' image will log the information, and then store it (and, in this case, it is displayed to you)."
You can't tell what sites I've been to if it's Slashdotted!
The CSS history hack has been known since (at least) August 2006: http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.html
I'd care a lot more about this if NoScript was still a viable option. NoScript has become malware at this point. The real issue is the need for someone more trustworthy to make a simpler, and more trustworthy replacement for NoScript. Please? Pretty please?
Find free books.
its easy to tell, with that nickname of yours.. :)
then it means you've come from Slashdot.
Doesn't work on me - Firefox, with adblock plus, element hiding helper, and flashblock, running whatever the latest Ubuntu is.
... and maybe even nefarious, but you've got to admit: it's a neat hack (in the original sense of the word--i.e., clever)
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Anyone who allows their browser to cache and keep a history is stupid? Perhaps your tin foil hat is a size too small.
Maybe just clear your cache more often. It's easy, fast and good practice. Ctrl-Shift-Del, press enter.
Do this every time you close FF.
You can't legislate goodness. Let each to his own destiny, by will of his freely made choices.
Some of us actually use the browser history.
It does not require an iframe. It's just that this way it's easier to hide any visual clues.
The basic hack works simple. It sets a different style for visited links. (As such it will only match exact URLs). And one of the cool things your style for visited links specifies is a background URL that works as a webbug.
yacc
Most people will never understand and basic exploits like this will always work against them.
So what, we shouldn't fix it then? The fix is dead-simple: the browser should load all "a:visited" images, regardless of whether or not it will display them.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
From an exploit standpoint, no. From an editorial standpoint, yes.
Sig this!
And some of us use one browser for their everyday surfing and one for the naughty pages... I mean, I would do that if I surfed to naughty pages, of course...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Small but important distinction: this exploit is for browser history, not cache. That shortcut (or shift-command-delete* on a Mac) will bring up the 'clear private data' dialog which covers browser history (the one this exploit is for), download history, saved form and search history, browser cache, and other items.
* Unlike PCs, which have 'backspace' and '(forward) delete' buttons, Macs have two buttons labeled 'delete' or 'del'--the big one which is backspace, and the small one next to help, home, end, etc., which is forward delete. That's the one you need for this shortcut. I imagine laptop users and people who use those new small keyboards are SOL.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
I'm letting it scan my browser now. So far the only thing it has found is Slashdot. It could maybe find sites that I've followed links from Slashdot to. But it won't find much because I run a separate browser instance, with its own (initially empty) browser history, cookies, etc, for each site I visit via by the means I have set up to start a new browser (command line script, and menu selection for the browser). And for those of you who are wanting to tell me "but Firefox just joins all startups into the same process and only gives you a new window". Well, I defeated that by dynamically creating a new home directory on the fly for each startup, populating it with a template set of files Firefox expects, setting the HOME environment variable to that path, and starting the Firefox process. So the scanning of my browser is limited to just what this one I use for Slashdot has visited recently.
now we need to go OSS in diesel cars
IMHO a better fix is to completely disable looking up browser history for link styling. Let it treat all links as unvisited if there is no difference in styling these different classes of links. Make it the default to use the same style (most people don't care). Then re-enable the lookup if the styles are changed and the result of the change is 2 or more different styles (and pop up a warning that JS and CSS and see these style variations and this can expose detection of sites you have visited).
now we need to go OSS in diesel cars
Comment removed based on user account deletion
You should only load remote images on demand.
[...]
Yeah , I know must be new here..
You're not new here, I can tell by the fact that you didn't read the article. Or the summary ;)
This feature actually works like you want it to: It *does* load on demand. And that's the problem here. If it always loaded it this exploit wouldn't work. Its based on only being loaded on demand.
would be a lot easier if I could run two separate instances of Firefox simultaneously.
Send Firefox developers a polite nasty-gram, telling them that you want the ability to open a second, third, or even fourth instance of FF in seperate memory space.
This functionality already exists.
"%programfiles%\Mozilla Firefox\firefox.exe" -P "profile to use" -no-remote
It's not DEAD-SIMPLE. I'd imagine the only real way is to kill "visited" functionality all together. Blocking images will just block that one exploit. JS isn't needed for this exploit, but it could be used to create other ones.
If a page has the rule: a:visited { color: red; }
And I have a link element with id="myElement". I can just do something like: if($('myElement').style.color === '#f00') alert('scream real loud (with ajax, or load an image.. or something)');
I just thought of that one off hand. Someone may be able to come up with something trickier that requires no js.
The point here is, the solution is not dead simple.
the "no mod and comment" rule is perhaps one of the most ill-concieved rules I have seen.
Then perhaps you haven't understood the concept behind the rule. The idea is to prevent individuals having unrestrained ability to push an agenda of their own: hence mod or post, but not both.
Unlike some other long-standing rules on this forum, this is one that actually has very sound reasoning behind it.
is there really a good need or use for a hidden flag on iframes at all??
I honestly don't know, maybe its one of the more handy features in there, and I just don't see it from the user side of things, but 'hidden' is not an attribute I would ever imagine wanting on a frame or iframe...
With CSS you can hide anything you want to, in a number of different ways, and there are myriad reasons for wanting to do this. Most ajax sites would look a lot worse if the frames they use to silently load your data in the background were suddenly visible.
putting the rule
a:visited {
background:none !important;
in userContent.css seems to stop this particular scan.
Unless you're visiting illegal sites.
Or sites that are unpopular among your peer group.
And what about people in repressive regimes who visit illegal sites?
By exposing your history, there is pressure on you to conform to the standards of those who hold power over you. Not a good thing.
I like having my browser history so I can tell if I've read something or not. ./ has found a way around that trick.
I think you'll find that
Just duplicate a story from 2000, 2006 and 2009 with slightly different url's.
The parent post is marked informative? Informative like it is easy to tell who is a terrorist by the length of their beard?
No, the simplest solution is to adopt a policy I took up in the late '90s when it first occurred to be that my history might be sniffed:
/dev/null, though I am aware that current browsers offer an option to clear it...
Delete it.
That's right. It's perfectly possible to live a fulfilled life without browser history, or cookies for that matter. In fact, I still have my cookies file symlinked to
Note: this works only in Firefox 3.5 (Beta/Preview).
By the way, if you are using Firefox 3.5 with layout.css.visited_links_enabled = false and you still want some visual clue for visited links, try my Link Status extension! (How pushy....)
or change the about:config setting called "layout.css.visited_links_enabled"